CISA Warns of Active Exploitation of OpenSSH, GPUStack, FreeSWITCH, and IBM Flaws Ravie LakshmananNov 10, 2026Vulnerability / Cyber Attack The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added four security flaws impacting GPUStack, SignalWire FreeSwitch, OpenBSD OpenSSH, and IBM Aspera Faspex to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. CVE-2026-123218 (CVSS score: 9.8) - An incorrect authorization vulnerability in IBM Aspera Faspex that could allow an authenticated user to craft a specific message to bypass authorization, causing privilege escalations. (Fixed in November 2026) CVE-2026-116779 (CVSS score: 9.8) - A code injection vulnerability in SignalWire FreeSwitch that could result in configuration and credential disclosure, arbitrary call control, and command execution. (Fixed in October 2026) CVE-2026-123158 aka SSHole (CVSS score: 8.1) - An unexpected status code or return value vulnerability in OpenBSD OpenSSH on Linux that could allow for authentication bypass. (Fixed in November 2026) CVE-2026-102895 (CVSS score: 9.8) - An improper authentication vulnerability in GPUStack that could allow improper authentication vulnerability which could allow unauthenticated administrative access, including user and model changes, persistent administrator API-key creation, disclosure of worker and cloud-provider secrets, and code execution through POST /v2/inference-backends/from-yaml. (Fixed in July 2026) The addition of CVE-2026-123158 to the KEV catalog follows reports of exploitation attempts targeting the flaw since November 6, 2026. A total of 22 exploitation attempts have been recorded from 14 unique IP addresses so far, according to Previdian. In a post shared on X on November 7, 2026, Defused Cyber said it "observed a small amount of actors targeting SSHole" but stressed the exploitation activity is not widespread yet. According to GreyNoise, the first exploitation attempt against its honeypot network was observed on November 7, 2026, at 12:46 a.m. UTC. Confirmed post-exploitation activity has been detected from six source IP addresses, representing 18 distinct attack chains to date. These involve reconnaissance, queries to cloud metadata services, attempts to read password hashes and root SSH keys, and efforts to modify the SSH authorized_keys file to gain persistent access. In at least one case, an unknown threat actor dubbed GT10 has been observed deploying TAC Agent, a Python-based command-and-control (C2) agent capable of shell command execution, system reconnaissance, directory enumeration, file transfer, and updating itself. Threat intelligence firm watchTowr said it has also observed the OpenSSH flaw being weaponized in the wild for botnet and cryptocurrency miner activity. In an advisory for CVE-2026-102895 published on July 31, 2026, the maintainers of the GPUStack Python package credited Nikko Enggaliano, Wei Yunzhou, Rui Yang, and Haoyu Wang for independently reporting the flaw, adding that "active in-the-wild exploitation" was reported by Ulex Innovative Systems' Javier Sixto. There are currently no public reports on how the other vulnerabilities are being exploited, who is behind them, and the scale of such efforts. Federal Civilian Executive Branch (FCEB) agencies are recommended to apply the fixes by November 12, 2026. Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post. Authentication, cryptocurrency, Cyber Attack, linux, network security, Vulnerability Claude Code's “Don't Ask Again” File Exposes Passwords and Keys in 1,122 Public Copies on GitHub ThreatsDay: Apache OFBiz RCE, DreamHost Breach, DeFi Site Hijacks + 17 More Stories Hackers Hide Linux Backdoor in Control Web Panel Server to Execute Commands Without Logs Debian and Ubuntu APT Flaw Lets MitM Attackers Swap Verified Packages and Run Code as Root The Collapsed Patch Window: Why Runtime Protection is Now Your First Line of Defense Against AI-Driven Attacks Is Your Exposure Management Platform Leaving You Exposed? Five Tests to Find Out Apple to Start Scanning Publicly Shared iCloud Photos and Files for Harmful Content OpenAI AI Pipeline Generates 948 Linux Root Escalation Exploits in 30-Hour Run The Rise of the Threat Operator: How AI Will Redefine Security Operations and Careers 5 Active Cyber Threats That Put US Enterprises at Risk in October 2026 Critical Rails Flaw Lets Attackers Write Server Files via Crafted ImageMagick Uploads Hackers Target OpenSSH SSHole Flaw Within Hours of Disclosure, Gain Root on Honeypot Google Issues Patches for Critical Android Flaw That Could Allow RCE Without User Interaction Google Warns LLMjacking Attacks Are Costing Some Enterprises Up to $1 Million in Cloud Charges Binance Reveals How Fake Job Interviews and AI Tool Abuse Led to $6.43 Billion Theft OpenSSH Issues Emergency Fix for Flaw Letting Long Passwords Bypass SSH Auth on Alpine Linux New Wave of Refrigeration Cyberattacks Hits Supermarkets Across Europe, Forcing Stores to Pull Food Xen Hypervisor Flaws Let One Malicious VM Read and Write Any Other VM's Memory Synology NAS Devices Targeted in Ransomware Attacks Exploiting Patched DSM Flaw Red Hat Patches 9.8-Rated Linux TCP RCE Flaw While Ubuntu Releases Fixes for Testing CISA Confirms Hackers Exploiting WordPress Core Flaw During Software Upgrades Microsoft Paint RCE Fix Now Available, but Windows Update Won't Deliver It The Flood is Coming And The Pipes Were Already Full Google Disrupts 1.3 Million-Device Android Botnet, Says TV Box Maker Sold Criminal Access Beyond CVE Scanning: Book a Demo of Continuous AI-Powered Web Pentesting Detect Lateral Movement and Evasive Attacks With Corelight's Open NDR Platform See How Bitdefender GravityZone Identifies Shadow AI and Prioritizes Endpoint Risks Assess Your Organization's AI Code Sprawl Exposure With This Practical Guide Your SOC Has an Identity Blind Spot. Here's How to Fix It Learn how to close critical identity visibility gaps in your SOC, detect hidden threats, and accelerate incident response across human, machine, and AI identities. Watch Free Now Roadmap for AI-Ready Security Operations Evaluate Attack Surface Visibility With an AI Threat Readiness Framework Learn how to assess AI threat readiness, strengthen attack surface visibility, and prepare security operations for emerging threats in this practical webinar. Uncover Identity Dark Matter: SACR Research Brief Eliminate the blind spots undermining your security. Download the SACR brief. 11 Real Stories: How Identity Exposure Unlocks Active Attack Paths Map cross-domain privilege escalation to sever breach routes at key choke points. Governance Sets the Ceiling on Your AI Security Program See the five moves that raise a Stage 2 Govern score to a defensible Stage 3. BeyondTrust an 8X Gartner® Magic Quadrant™ Leader for PAM Gain clarity on the PAM market and understand why BeyondTrust is again a Leader. The Collapsed Patch Window: Why Runtime Protection is Now Your First Line of Defense Against AI-Driven Attacks Your Attack Surface Is Growing Faster Than Your Team Can Respond The MSP Margin Math Nobody's Doing: Your Next Technician Might Already be on Payroll PEDM vs. Standing Elevated Privileges: Control Access Without Flooding the Helpdesk